Vendor scorecard
Ruckus / CommScope
Ruckus / CommScope security disclosure record — CVE volume, CVSS severity mix and product-category breakdown, sourced from the NIST NVD.
CPE: ruckuswireless, commscope
Product families
3
Open in latest
3
Inferred — see methodology
Last disclosure
Dec 7, 2023
01
Product categories
3 trackedCVE volume, severity mix and the inferred latest shipping version per category.
| Category | CVEs | Volume | Severity mix | Open | Inferred latest |
|---|---|---|---|---|---|
| Unleashed / ZoneDirectorWireless LANunleashed, zonedirector, zonedirector_firmware | 13 | 3 | 10.5.1LOW | ||
| SmartZone / ControllersWireless LANsmartzone, virtual_smartzone, smartzone_firmware | 1 | 1 | 6.1.1LOW | ||
| RUCKUS One / AnalyticsWireless LAN · Network Management & Monitoringruckus_analytics | 0 | 0 | unknown |
02
Recent CVEs
12 shownMost recently published, newest first. Each ID links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2023-49225(opens NVD record) | Medium | 6.1 | A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see the information provided by the vendor listed under [References] section or the list under [Product Status] section. | Dec 7, 2023 |
| CVE-2020-21161(opens NVD record) | Medium | 6.1 | Cross Site Scripting (XSS) vulnerability in Ruckus Wireless ZoneDirector 9.8.3.0. | Jun 27, 2022 |
| CVE-2019-19839(opens NVD record) | Critical | 9.8 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-category to admin/_cmdstat.jsp via the uploadFile attribute. | Jan 23, 2020 |
| CVE-2019-19838(opens NVD record) | Critical | 9.8 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/_cmdstat.jsp via the uploadFile attribute. | Jan 23, 2020 |
| CVE-2019-19837(opens NVD record) | Medium | 5.3 | Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests. | Jan 23, 2020 |
| CVE-2019-19835(opens NVD record) | High | 7.5 | SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI. | Jan 23, 2020 |
| CVE-2019-19842(opens NVD record) | Critical | 9.8 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=spectra-analysis to admin/_cmdstat.jsp via the mac attribute. | Jan 22, 2020 |
| CVE-2019-19841(opens NVD record) | Critical | 9.8 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capture to admin/_cmdstat.jsp via the mac attribute. | Jan 22, 2020 |
| CVE-2019-19840(opens NVD record) | Critical | 9.8 | A stack-based buffer overflow in zap_parse_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remote code execution via an unauthenticated HTTP request. | Jan 22, 2020 |
| CVE-2019-19843(opens NVD record) | Critical | 9.8 | Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache. | Jan 22, 2020 |
| CVE-2019-19836(opens NVD record) | Critical | 9.8 | AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses tools/_rcmdstat.jsp to write to a specified filename. | Jan 22, 2020 |
| CVE-2019-19834(opens NVD record) | High | 7.2 | Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via enable->debug->script->exec with ../../../bin/sh as the parameter. | Jan 22, 2020 |
13 CVEs · 3 product families